NAT best practice with zone based firewall

[ktravis02]

Good Day, I am configuring a new router and want to simplify the configuration as much as I can. It occurred to me that instead of limiting access with NAT specifying ports, that I do that already using the Zone Base Firewall access list. I should be able to just use ip nat inside source static IPAddress IPAddress. Does any one see any problem with doing so?

Thanks,

Ken

[Jon Marshall · Accepted solution]

I have come across different opinions on this but personally I don't see a problem with it all. 

I tend to think of using ports in static translations when you do not have enough IP addresses rather than as a security feature because as you rightly say the security element is your access list not your NAT configuration. 

You could make the argument that using ports is a additional level of security because if you make a mistake in your access list you still are only allowing through certain ports but I don't really see that as a valid argument ie. you should not be relying on NAT at all as a security feature as that was never it's intended purpose. 

Others may disagree :) 

Jon

[Deepak Kumar]

Hi,

I little agree with Jon but I am thinking that why would I allow for performing nat if it is really not required for a port? As example: I need only 443 port to be open but if anyone will trying to pull the traffic on 8080 then router must be translated it first into the required ip and after that will check for your ACL and zone based inspection.

It is wasted of router resources. 

Regards,

Deepak Kumar